We depend greatly on the efforts of our executive officers and other key employees to manage our operations. The loss or unavailability of any of our executive officers or other key employees could have a material adverse effect on our business.
Item 1(b) | Unresolved Staff Comments
Item 1(b) | Unresolved Staff Comments
Item 1(b). Unresolved Staff Comments.
None.
Item 1(c). Cybersecurity.
We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities is integrated into our enterprise risk management program and enterprise risk assessment process. This provides cross-functional and geographical visibility, as well as executive leadership oversight, to address and mitigate associated risks. We engage our internal IT audit group to audit our information security programs, and the results are reported to our executive management and the Audit Committee of our Board of Directors. We also engage third party firms to identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework, NIST 800-53, NIST 800-82, and International Electrotechnical Commission 62443.
In managing material risks from cybersecurity threats, we require that a security and technical architecture review is conducted for all new software and applications, and for all changes to the underlying information technology (IT) infrastructure that manages, processes, stores, or transmits our data or data of our customers, vendors, suppliers, joint ventures, or employees. Any deviations from our IT security policies and standards are assessed by our IT Security Governance team. Any critical and high-risk levels that are identified are then documented and reported to relevant key stakeholders.
Our policies and procedures also address the oversight, identification, and mitigation of cybersecurity risks associated with our use of third-party service providers. Our policy requires that each third-party service provider go through a mandatory IT Security Governance review and obtain formal approval by our IT Security Governance group before it can be used.
We have an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. This plan requires an Incident Manager to determine whether a cybersecurity incident has occurred and to communicate such findings to the Incident Response Team. In the event there is a cyber security incident, the Incident Manager and the Incident Response Team will assess the cybersecurity incident’s impact as the basis for assigning a preliminary severity rating. The Incident Manager then provides the Chief Information Security Officer (CISO) with a summary and preliminary severity rating and the CISO subsequently notifies the Chief Information Officer (CIO) as appropriate. Cyber Incident Response Leadership, which is comprised of the CIO, CISO, and Incident Manager, assesses situational information and business impact to confirm the preliminary severity rating assessment. The CIO and CISO are responsible for communicating incidents to other members of management as appropriate. Were a cybersecurity incident to occur that was determined to be material by our management and Cyber Incident Response Leadership, they would notify our Board of Directors. Should any incidents occur that have a preliminary severity rating of high or critical, our Cyber Incident Response Leadership would confer with our Cybersecurity Disclosure Committee to determine whether to report the cybersecurity incident in our public filings.
Aside from more immediate reporting of material incidents to our Board of Directors as described above, our CISO provides our Board of Directors an update on cybersecurity during each of its quarterly meetings. This update includes metrics on the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks. In addition, our Audit Committee receives a detailed update annually from the CIO and CISO, which includes in-depth updates on our cybersecurity program and strategy including cybersecurity risks.
The CIO leads all components of our IT functions. Our CIO has over 40 years of experience with Halliburton and has had numerous global assignments across all areas of IT delivery, operations, and management. Our CISO has served in that role since 2021. Since joining Halliburton in 2010, the CISO has held various leadership roles in IT, including architecture, infrastructure management and security, and enterprise platform management.
No unauthorized access to customer, vendor, supplier, joint venture, employee or our data occurred as a result of cybersecurity incidents against us that has had a material adverse effect on our business, operations, or consolidated financial condition. If our systems, or our customers' or suppliers' systems, for protecting against cybersecurity incidents prove to be insufficient, a cybersecurity incident could have a material adverse effect on our business, operations, or consolidated financial condition. See additional information about our cybersecurity risks under General Risk factors in Item1(a) Risk Factors.